go-git

Records15All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

go-git records in CISA KEV

No go-git vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Go-git 11 records MEDIUM

Records

15 records

TI-2023-27070 CVE-2023-49569 · GHSA-449p-3h89-pw88

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

MEDIUM 52

A path traversal vulnerability was discovered in go-git versions prior to v5.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0151 Published 2024-01-12 Partial fix · 5.11.0 CWE-22

TI-2025-15573 CVE-2025-21613 · GHSA-v725-9546-7q7m

go-git has an Argument Injection via the URL field

MEDIUM 44

go-git is a highly extensible git implementation library written in pure Go.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01278 Published 2025-01-06 Partial fix · 5.13.0 CWE-88

TI-2025-15574 CVE-2025-21614 · GHSA-r9px-m959-cxf4

go-git clients vulnerable to DoS via maliciously crafted Git server replies

MEDIUM 40

go-git is a highly extensible git implementation library written in pure Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00717 Published 2025-01-06 Partial fix · 5.13.0 CWE-400

TI-2026-32835 CVE-2026-44973 · GHSA-qw64-3x98-g7q2

Billy: Path traversal vulnerabilities

LOW 35

Billy is an interface filesystem abstraction for Go.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0031 Published 2026-05-28 Partial fix · 5.9.0, 6.0.0-alpha.1 CWE-22

TI-2023-27069 CVE-2023-49568 · GHSA-mw99-9chc-xw7r

Maliciously crafted Git server replies can cause DoS on go-git clients

LOW 34

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00698 Published 2024-01-12 Partial fix · 5.11.0 CWE-20

TI-2026-30091 CVE-2026-41506 · GHSA-3xc5-wrhm-f963

go-git Credential leak via cross-host redirect in smart HTTP transport

LOW 32

go-git is an extensible git implementation library written in pure Go.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00259 Published 2026-05-08 Partial fix · 5.18.0, 6.0.0-alpha.2 CWE-522

TI-2026-50128 CVE-2026-71556 · GHSA-hc8v-wwc9-vgxm

go-git: Worktree operations may follow symlinks

LOW 31

go-git is an extensible git implementation library written in pure Go.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00357 Published 2026-08-07 Partial fix · 5.19.2, 6.0.0-alpha.5 CWE-59

TI-2026-32877 CVE-2026-45022 · GHSA-389r-gv7p-r3rp

go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

LOW 30

go-git is an extensible git implementation library written in pure Go.

CVSS 4.0HIGH 7.0 Network Low privileges No interaction EPSS 0.00159 Published 2026-05-27 Fixed in 5.19.0, 6.0.0-alpha.3 CWE-180

TI-2026-32627 CVE-2026-44740 · GHSA-m3xc-h892-ggx6

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

LOW 29

Billy is an interface filesystem abstraction for Go.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-06-01 Partial fix · 5.9.0, 6.0.0-alpha.1 CWE-674

TI-2026-50129 CVE-2026-71557 · GHSA-qgq7-7hm3-q39j

go-git: Malicious reference names may modify files outside the reference storage

LOW 28

go-git is an extensible git implementation library written in pure Go.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00413 Published 2026-08-07 Partial fix · 5.19.2, 6.0.0-alpha.5 CWE-22

TI-2026-33320 CVE-2026-45571 · GHSA-crhj-59gh-8x96

go-git: Crafted repositories may modify main and submodule .git directories

LOW 24

go-git is an extensible git implementation library written in pure Go.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00297 Published 2026-05-27 Fixed in 5.19.1, 6.0.0-alpha.4 CWE-22

TI-2026-26465 CVE-2026-34165 · GHSA-jhf3-xxhw-2wpp

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

LOW 22

go-git is an extensible git implementation library written in pure Go.

CVSS 3.1MEDIUM 5.0 Local Low privileges User interaction EPSS 0.00153 Published 2026-03-31 Partial fix · 5.17.1 CWE-191

TI-2026-20964 CVE-2026-25934 · GHSA-37cx-329c-33x3

go-git improperly verifies data integrity values for .idx and .pack files

LOW 19

go-git is a highly extensible git implementation library written in pure Go.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00156 Published 2026-02-09 Partial fix · 5.16.5 CWE-354

TI-2026-26141 CVE-2026-33762 · GHSA-gm2x-2g9h-ccm8

go-git: Missing validation decoding Index v4 files leads to panic

LOW 13

go-git is an extensible git implementation library written in pure Go.

CVSS 3.1LOW 2.8 Local Low privileges User interaction EPSS 0.00177 Published 2026-03-31 Partial fix · 5.17.1 CWE-129

TI-2026-33319 CVE-2026-45570 · GHSA-m7cr-m3pv-hgrp

go-git: Improper single-quote escaping in go-git SSH transport

LOW 12

go-git is an extensible git implementation library written in pure Go.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00365 Published 2026-05-27 Fixed in 5.19.1, 6.0.0-alpha.4 CWE-116

Open these records in search →

Critical	2
High	6
Medium	5
Low	2
No CVSS	0